Synology Urges NAS Updates as C3RB3R Ransomware Spreads

Synology is warning customers to update their network-attached storage devices immediately as C3RB3R ransomware attacks spread. An infected NAS can leave a household or small office unable to open stored photos, documents and other important files unless it has a separate usable copy.

What happened

Attackers are exploiting a security flaw that Synology patched in December 2024, according to BleepingComputer. The company says the attacks target devices running outdated versions of DiskStation Manager, or DSM, and encrypt their data before demanding payment.

Synology has not disclosed which vulnerability the attackers are using. The company pointed readers to a November 2024 advisory covering separate flaws that could allow someone to run code or read and write files on an unpatched device, but it did not confirm which one is connected to the current campaign.

Reports from affected customers began appearing more than two weeks before the warning, BleepingComputer reported. Victims found a ransom note named read-me3.txt, while encrypted filenames carried the .L0CK3D extension. The note directed victims to a dark-web site selling a tool called C3rb3r Decryptor for thousands of dollars.

Who is affected

The warning applies to Synology NAS owners using vulnerable, outdated DSM software. Synology has not disclosed the affected device models or said how many NAS systems have been encrypted.

Devices whose management web interface is reachable from the internet face particular concern because Synology specifically advised customers to block that access. Shadowserver currently tracks more than 380,000 internet-exposed Synology NAS devices, according to BleepingComputer, although that count may include secured systems and monitoring traps.

What to do now

1. Sign in to DSM and install the newest available update immediately. Check the installed version after the process finishes rather than assuming the device updated itself. Synology says moving vulnerable systems to the latest DSM release protects them from this attack.

2. Enable automatic DSM updates. Open the NAS software-update settings and turn on automatic installation so future security fixes do not depend on someone remembering to check manually. Exact menu labels can differ, and Synology did not provide model-specific directions in the cited warning.

3. Remove the DSM management page from the public internet. Disable any setup that lets people reach the NAS administration interface directly from outside your home or office. If remote administration is unnecessary, keep it available only on the local network. Our home network security guide explains additional ways to reduce exposure.

4. Check every Synology NAS you manage. Updating one device does not update another. Review each unit separately, especially systems used for family photos, office documents or shared storage.

If you see read-me3.txt or files ending in .L0CK3D, treat the NAS as potentially infected. The source did not report a Synology recovery method or confirm that paying the attackers will restore files.